dynamically generates secret token